CVE-2019-16057
D-Link DNS-320 Remote Code Execution Vulnerability
Description
CVE-2019-16057 is a remote code execution vulnerability in the D-Link DNS-320 storage device, specifically in the login_mgr.cgi script. This critical vulnerability allows a remote, unauthenticated attacker to execute arbitrary commands on the device, gaining full control over the NAS storage system and all data it contains. The D-Link DNS-320 is an end-of-life product that will not receive firmware updates, making this vulnerability permanently unpatched. CISA has added CVE-2019-16057 to the Known Exploited Vulnerabilities catalog with the required action to disconnect the device if still in use, as the remediation deadline was May 6, 2022. The vulnerability is known to be used in ransomware campaigns, and the EPSS percentile of approximately 99.85% indicates near-certain exploitation activity.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| dlink | dns-320 firmware | <= 2.05.b10 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://blog.cystack.net/d-link-dns-320-rce/(Exploit, Third Party Advisory)
- https://www.ftc.gov/system/files/documents/cases/dlink_proposed_order_and_judgment_7-2-19.pdf(Third Party Advisory, US Government Resource)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-16057(US Government Resource)
Weakness Type
Remote Code Execution in D-Link DNS-320
The vulnerability in the D-Link DNS-320 login_mgr.cgi script allows an unauthenticated remote attacker to execute arbitrary operating system commands on the storage device. The CGI script fails to properly validate or sanitize user input before processing it, enabling command injection that provides the attacker with full control over the device's operating system.
Learn more: CWE-78 — Improper Neutralization of Special Elements used in an OS Command (OS Command Injection)
Impact Analysis
CVE-2019-16057 is remotely exploitable over the network without any authentication or user interaction, making it trivially exploitable by automated scanning tools and botnets. The remote code execution through the login_mgr.cgi script provides the attacker with full control over the D-Link DNS-320 NAS device, compromising the confidentiality of all stored data including documents, backups, and media files. The integrity of the storage system is fully undermined as attackers can modify, encrypt, or delete any data on the device, and the availability is at critical risk given the confirmed use of this vulnerability in ransomware campaigns. The EPSS percentile of approximately 99.85% indicates near-certain exploitation activity, and the end-of-life status of the D-Link DNS-320 means no firmware patches will be released, leaving the vulnerability permanently exploitable on any device that remains connected to a network.
Exploit Maturity
CISA has confirmed active exploitation of CVE-2019-16057 in the wild by including it in the Known Exploited Vulnerabilities catalog. The required action states: "The impacted product is end-of-life and should be disconnected if still in use." The vulnerability is known to be used in ransomware campaigns, indicating that criminal groups are actively targeting D-Link DNS-320 devices to encrypt stored data for extortion. The EPSS percentile of approximately 99.85% indicates near-certain exploitation activity. The combination of trivial exploitation, ransomware association, and no available patches makes CVE-2019-16057 an extremely high-risk vulnerability for any organization still operating D-Link DNS-320 devices.
Remediation
-
Disconnect D-Link DNS-320 devices immediately as directed by CISA: "The impacted product is end-of-life and should be disconnected if still in use." Since no firmware update will be released, the only effective remediation is to remove the device from any network.
-
Migrate data to a supported storage solution before disconnecting the DNS-320. Transfer all data to a current, actively maintained NAS device or cloud storage platform that receives regular security updates.
-
If immediate disconnection is not possible, isolate the DNS-320 on a dedicated VLAN with no internet access and strict firewall rules preventing any inbound connections from untrusted networks. Block all external access to the login_mgr.cgi endpoint and any other management interfaces.
-
Scan for indicators of ransomware compromise before migrating data from the DNS-320. Check for encrypted files, ransom notes, unauthorized file modifications, and any signs that the device has already been compromised, particularly given the confirmed ransomware usage of this vulnerability.
-
Inventory all end-of-life network devices in your environment and establish a lifecycle management process to ensure devices are replaced before they reach end-of-life status. D-Link DNS-320 devices should be prioritized for immediate replacement given the active ransomware exploitation.
Technical Details
CVE-2019-16057 is a remote code execution vulnerability in the login_mgr.cgi script of the D-Link DNS-320 NAS storage device. The vulnerability allows an unauthenticated remote attacker to inject and execute arbitrary operating system commands through the CGI script's handling of HTTP request parameters. The login_mgr.cgi script fails to properly sanitize user input before incorporating it into system-level operations, enabling command injection through specially crafted HTTP requests. The attack requires no authentication, no user interaction, and can be executed with a single HTTP request, providing immediate command execution on the device's underlying Linux-based operating system. As an end-of-life product, the D-Link DNS-320 will not receive a firmware patch, making this vulnerability a permanent security risk for any device that remains operational.
Frequently Asked Questions
Is CVE-2019-16057 being actively exploited?
Yes, CVE-2019-16057 is being actively exploited in the wild, including in ransomware campaigns. CISA has added it to the Known Exploited Vulnerabilities catalog and recommends disconnecting the device since it is end-of-life. The EPSS percentile of approximately 99.85% confirms near-certain exploitation.
What products are affected by CVE-2019-16057?
CVE-2019-16057 affects the D-Link DNS-320 storage device. This product has reached end-of-life and will not receive firmware updates. Any DNS-320 device still connected to a network is permanently vulnerable.
How do I fix CVE-2019-16057?
The D-Link DNS-320 is end-of-life and will not be patched. CISA's required action is to disconnect the device. Migrate all data to a supported storage solution and remove the DNS-320 from your network immediately.
How severe is CVE-2019-16057?
CVE-2019-16057 is an extremely severe vulnerability with an EPSS percentile of approximately 99.85% and confirmed use in ransomware attacks. The remote code execution requires no authentication and the device will never be patched, making disconnection the only effective remediation.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.